CVE-2023-53270 - Vulnerability Details

- ext4: fix i_disksize exceeding i_size problem in paritally written case

Description

In the Linux kernel, the following vulnerability has been resolved:

ext4: fix i_disksize exceeding i_size problem in paritally written case

It is possible for i_disksize can exceed i_size, triggering a warning.

generic_perform_write
copied = iov_iter_copy_from_user_atomic(len) // copied < len
ext4_da_write_end
| ext4_update_i_disksize
| new_i_size = pos + copied;
| WRITE_ONCE(EXT4_I(inode)->i_disksize, newsize) // update i_disksize
| generic_write_end
| copied = block_write_end(copied, len) // copied = 0
| if (unlikely(copied < len))
| if (!PageUptodate(page))
| copied = 0;
| if (pos + copied > inode->i_size) // return false
if (unlikely(copied == 0))
goto again;
if (unlikely(iov_iter_fault_in_readable(i, bytes))) {
status = -EFAULT;
break;
}

We get i_disksize greater than i_size here, which could trigger WARNING
check 'i_size_read(inode) < EXT4_I(inode)->i_disksize' while doing dio:

ext4_dio_write_iter
iomap_dio_rw
__iomap_dio_rw // return err, length is not aligned to 512
ext4_handle_inode_extension
WARN_ON_ONCE(i_size_read(inode) < EXT4_I(inode)->i_disksize) // Oops

WARNING: CPU: 2 PID: 2609 at fs/ext4/file.c:319
CPU: 2 PID: 2609 Comm: aa Not tainted 6.3.0-rc2
RIP: 0010:ext4_file_write_iter+0xbc7
Call Trace:
vfs_write+0x3b1
ksys_write+0x77
do_syscall_64+0x39

Fix it by updating 'copied' value before updating i_disksize just like
ext4_write_inline_data_end() does.

A reproducer can be found in the buganizer link below.

Published: 2025-09-16

Score: 5.5 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`64769240bd07f446f83660bb143bb609d8ab4910`	affected	< 18eb23891aeae3229baf8c7c23b76be3364e1967
`64769240bd07f446f83660bb143bb609d8ab4910`	affected	< d30090eb546d993ea3f3023452540c476ea614a5
`64769240bd07f446f83660bb143bb609d8ab4910`	affected	< 3ecea2fee14227712694c8b54ad99d471e61de92
`64769240bd07f446f83660bb143bb609d8ab4910`	affected	< 53877ed201baa6b58f7ce9df92664a839113c30e
`64769240bd07f446f83660bb143bb609d8ab4910`	affected	< 1dedde690303c05ef732b7c5c8356fdf60a4ade3

Linux

affected

Version	Status	Constraints
`2.6.27`	affected	—
`0`	unaffected	< 2.6.27
`5.15.111`	unaffected	≤ 5.15.*
`6.1.28`	unaffected	≤ 6.1.*
`6.2.15`	unaffected	≤ 6.2.*
`6.3.2`	unaffected	≤ 6.3.*
`6.4`	unaffected	≤ *

Configuration 1 [-]

OR	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::

No data.

Vendor	Product	Confidence	Versions
Linux	Linux Kernel	—	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
EUVD	EUVD-2023-59919	In the Linux kernel, the following vulnerability has been resolved: ext4: fix i_disksize exceeding i_size problem in paritally written case It is possible for i_disksize can exceed i_size, triggering a warning. generic_perform_write copied = iov_iter_copy_from_user_atomic(len) // copied < len ext4_da_write_end \| ext4_update_i_disksize \| new_i_size = pos + copied; \| WRITE_ONCE(EXT4_I(inode)->i_disksize, newsize) // update i_disksize \| generic_write_end \| copied = block_write_end(copied, len) // copied = 0 \| if (unlikely(copied < len)) \| if (!PageUptodate(page)) \| copied = 0; \| if (pos + copied > inode->i_size) // return false if (unlikely(copied == 0)) goto again; if (unlikely(iov_iter_fault_in_readable(i, bytes))) { status = -EFAULT; break; } We get i_disksize greater than i_size here, which could trigger WARNING check 'i_size_read(inode) < EXT4_I(inode)->i_disksize' while doing dio: ext4_dio_write_iter iomap_dio_rw __iomap_dio_rw // return err, length is not aligned to 512 ext4_handle_inode_extension WARN_ON_ONCE(i_size_read(inode) < EXT4_I(inode)->i_disksize) // Oops WARNING: CPU: 2 PID: 2609 at fs/ext4/file.c:319 CPU: 2 PID: 2609 Comm: aa Not tainted 6.3.0-rc2 RIP: 0010:ext4_file_write_iter+0xbc7 Call Trace: vfs_write+0x3b1 ksys_write+0x77 do_syscall_64+0x39 Fix it by updating 'copied' value before updating i_disksize just like ext4_write_inline_data_end() does. A reproducer can be found in the buganizer link below.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00017.

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://git.kernel.org/stable/c/18eb23891aeae3229baf8c7c23b76be3364e1967
https://git.kernel.org/stable/c/1dedde690303c05ef732b7c5c8356fdf60a4ade3
https://git.kernel.org/stable/c/3ecea2fee14227712694c8b54ad99d471e61de92
https://git.kernel.org/stable/c/53877ed201baa6b58f7ce9df92664a839113c30e
https://git.kernel.org/stable/c/d30090eb546d993ea3f3023452540c476ea614a5
https://lore.kernel.org/linux-cve-announce/2025091603-CVE-2023-53270-4af2@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2023-53270
https://www.cve.org/CVERecord?id=CVE-2023-53270

History

Wed, 14 Jan 2026 18:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Wed, 03 Dec 2025 17:00:00 +0000

Type	Values Removed	Values Added
Weaknesses		NVD-CWE-noinfo
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Metrics	cvssV3_1 `{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}`

Wed, 17 Sep 2025 11:00:00 +0000

Type	Values Removed	Values Added
First Time appeared		Linux Linux linux Kernel
Vendors & Products		Linux Linux linux Kernel

Wed, 17 Sep 2025 00:15:00 +0000

Type	Values Removed	Values Added
References		https://lore.kernel.org/linux-cve-announce/2025091603-CVE-2023-53270-4af2@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2023-53270 https://www.cve.org/CVERecord?id=CVE-2023-53270
Metrics	threat_severity `None`	cvssV3_1 `{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}` threat_severity `Moderate`

Tue, 16 Sep 2025 08:15:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: ext4: fix i_disksize exceeding i_size problem in paritally written case It is possible for i_disksize can exceed i_size, triggering a warning. generic_perform_write copied = iov_iter_copy_from_user_atomic(len) // copied < len ext4_da_write_end \| ext4_update_i_disksize \| new_i_size = pos + copied; \| WRITE_ONCE(EXT4_I(inode)->i_disksize, newsize) // update i_disksize \| generic_write_end \| copied = block_write_end(copied, len) // copied = 0 \| if (unlikely(copied < len)) \| if (!PageUptodate(page)) \| copied = 0; \| if (pos + copied > inode->i_size) // return false if (unlikely(copied == 0)) goto again; if (unlikely(iov_iter_fault_in_readable(i, bytes))) { status = -EFAULT; break; } We get i_disksize greater than i_size here, which could trigger WARNING check 'i_size_read(inode) < EXT4_I(inode)->i_disksize' while doing dio: ext4_dio_write_iter iomap_dio_rw __iomap_dio_rw // return err, length is not aligned to 512 ext4_handle_inode_extension WARN_ON_ONCE(i_size_read(inode) < EXT4_I(inode)->i_disksize) // Oops WARNING: CPU: 2 PID: 2609 at fs/ext4/file.c:319 CPU: 2 PID: 2609 Comm: aa Not tainted 6.3.0-rc2 RIP: 0010:ext4_file_write_iter+0xbc7 Call Trace: vfs_write+0x3b1 ksys_write+0x77 do_syscall_64+0x39 Fix it by updating 'copied' value before updating i_disksize just like ext4_write_inline_data_end() does. A reproducer can be found in the buganizer link below.
Title		ext4: fix i_disksize exceeding i_size problem in paritally written case
References		https://git.kernel.org/stable/c/18eb23891aeae3229baf8c7c23b76be3364e1967 https://git.kernel.org/stable/c/1dedde690303c05ef732b7c5c8356fdf60a4ade3 https://git.kernel.org/stable/c/3ecea2fee14227712694c8b54ad99d471e61de92 https://git.kernel.org/stable/c/53877ed201baa6b58f7ce9df92664a839113c30e https://git.kernel.org/stable/c/d30090eb546d993ea3f3023452540c476ea614a5

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2025-09-16T08:06:59.730Z

Updated: 2026-05-11T19:41:40.526Z

Reserved: 2025-09-16T08:05:12.516Z

Link: CVE-2023-53270

Vulnrichment

Updated: 2026-01-14T18:05:18.579Z

NVD

Status : Modified

Published: 2025-09-16T08:15:35.790

Modified: 2026-01-14T19:16:17.833

Link: CVE-2023-53270

Redhat

Severity : Moderate

Publid Date: 2025-09-16T00:00:00Z

Links: CVE-2023-53270 - Bugzilla

OpenCVE Enrichment

Updated: 2025-09-17T10:05:08Z

Weaknesses

NVD-CWE-noinfo

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Exploitation none

Automatable no

Technical Impact partial

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object